Logging centralizzato e rotazione con journald e logrotate

Cron jobs, systemd services, and shell functions all produce output. To run unattended systems you must capture, search, and rotate that output. Enter journalctl and logrotate.

systemd-journald collects logs from services you manage with systemctl into a structured binary journal you query with journalctl.

Plain journalctl shows everything; -e jumps to the end (newest entries).

-u limits the journal to one unit, perfect for debugging a single service.

-f streams new entries as they arrive, like tail -f for systemd.

--since and -p narrow results. Here we show errors from the last hour.

Journals can grow large. --vacuum-size trims them to a target size.

Many apps still write to /var/log/*.log. logrotate rotates, compresses, and deletes these on a schedule so disks do not fill.

Drop a config in /etc/logrotate.d/. This rotates daily, keeps 7 copies, and compresses old ones.

-d does a debug dry run that shows what would happen without changing files; -f forces an immediate rotation.

Have cron jobs and functions log to a dedicated file, manage that file with a logrotate rule, and use journalctl for everything run as a systemd service. Now nothing fills the disk silently.

Which journalctl option shows logs for a single systemd service?

You can keep automated systems observable and tidy:

• journalctl -u, -f, --since, -p query systemd logs
• --vacuum-size trims the journal
• logrotate rotates/compresses plain-text logs via /etc/logrotate.d/
• logrotate -d dry-runs your config